First seen April 10, 2026 · Last seen May 24, 2026 · Campaign
Public preview
IOC type, status and defensive guidance visible. Pro adds alert context, Pro+ adds exports and deeper relationships.
Context
Mock staging server for CraneShell web shell deployment in Operation Glass Tower. RFC 5737 documentation address.
Defensive Guidance
Monitor for web shell upload patterns. Inspect outbound HTTPS to this range. Review DMZ server integrity.
Tags
Safety Note
RFC 5737 documentation IP (198.51.100.0/24). Not a real indicator.
Actions
Related Threat Feed Items
Deeper context available with Pro+
View plans →
